Activity Menu

Main navigation

Breadcrumb

Collaborating companies: shady moves in a secretive sector

Wednesday, May 27, 2015

There is a common practice within the surveillance industry that makes the already murky market even harder to track: collaborating companies.

Within Privacy International's Surveillance Industry Index there are 83 documents detailing collaborations between companies involved in developing and selling surveillance technologies. These documents represent a variety of relationships – some are friendly companies, others advertise corporate partners, and some present themselves as a distributor of another's product.

These collaborations have real consequences, especially when it comes to holding the industry accountable. A Freedom of Information request from Privacy International to the Department for Business Innovation & Skills has confirmed that Datong, a Leeds-based surveillance company, attempted to export surveillance technology to an unnamed Asia Pacific country in 2009. However, it was not a Datong product that the company was trying to export, but in fact an IMSI Catcher built by Surrey-based Cellxion. Datong was acting as a distributor of Cellxion's product.

It is a common practice in the industry, which presents a challenge to export control authorities in their attempts to regulate effectively. The obfuscation that can occur by using networks of resellers, distributors and partner companies means that understanding the true destination of a product is made more difficult. The nature of the surveillance industry also means that combining two pieces of technology can create a remarkably more powerful system than if deployed separately. This raises further important questions about how to effectively regulate these technologies.

Cellxion and Datong: manufacturers and distributors

Coverage by the Guardian in 2011 suggested that an Asian Pacific country had tried to purchase a product from Datong in 2009. Datong made a request to the export control authority in the United Kingdom, the Department of Business, Innovation and Skills (BIS). This request to export was rejected by BIS on the grounds of risks of human rights abuse. Datong is now owned by Seven Technologies Group. At the time, no information was given about the type of technology that Datong was attempting to export. Privacy International lodged a Freedom of Information request in May 2014 to attempt to identify the type of technology to better understand why BIS rejected the export application.

While the rumour of the rejection was confirmed the document threw up further questions. The technology in question was given a name "Optima", and was referred to as a BTS transceiver module. BTS refers to Base Transceiver Stations - something which an IMSI Catcher will emulate - which further confirms the technology that Datong were attempting to export. However Datong did notactually build IMSI Catchers. Neither did the name Optima refer to any of their products. Datong built products for location monitoring through tracking devices, not intercepting data from mobile phones.

What was Optima? Why were Datong selling it? Had Datong been building and selling IMSI Catchers all along without specifically advertising that technology?

While this finally revealed the manufacturer of the product, the relationship between Datong and Cellxion remained unclear from the court case. Cellxion's lawyers however, confirmed that Datong was in fact the UK distributor for Cellxion and their Optima IMSI Catcher.

This relationship between Datong and Cellxion – and and the difficulty in revealing it – is not unique. This is the private surveillance sector, where secrecy and obfuscation are natural operating policies for these companies. This makes the effective regulation of these technologies very difficult.

Collaborating to avoid responsibility

Some companies have used the relationship between manufacturers and distributors to absolve themselves of responsibilities for any misuse that surveillance technologies are put to. The prevalence of these relationships has also allowed one company in particular – Elaman – to position themselves as the surveillance industry's middleman. Finally, the combination of particular products could provide a much greater capacity than originally considered. This is another issue that export control authorities will need to weigh up in their consideration of applications for export licences.

Utimaco are a German company that acts as an Original Equipment Manufacturer (OEM) by providing mediation systems for surveillance on communications networks. These systems have been used in Iran, Tunisia and Syria. Utimaco took no responsibility for the sale of their product to Tunisia and Iran. At the time both countries had civil society under heavy oppression. Utimaco brushed the sales off as an issue of resellers selling on their products. They claimed they had not sold the product directly to these states so they could claim they weren't at fault for any use of their product for oppression. The manufacturer/distributor relationship appears to add - in the eyes of Utimaco - impunity to their actions. By providing a degree of separation between the manufacturer and the distributor, culpability for any sale to a repressive regime is at the feet of the salesperson. It fails to ask difficult questions of the manufacturer of such invasive technologies, while allowing companies' callousness over the use of the technologies to become a normal practice for the industry.

The decision in 2013 to place export controls on intrusion technologies and massive IP monitoring is a huge step forward in effectively safeguarding against exports of powerful surveillance technology to rights abusing regimes. Without export controls, Datong would never have been prevented from exporting Cellxion's IMSI Catcher. However, even with export controls in place the relationship between manufacturers of a product and their distributors complicates the enforcement of controls.

Export controls can only be wielded in an effective manner through understanding the relationships, the alliances, the distribution networks and the multi-faceted projects undertaken in this sector. Uncovering the practices of this secretive industry and holding it to account takes more than knowing who the technologies are being sold to, it also requires authorities to know who the companies are collaborating with along the way.